|
1
|
<?php
|
|
2
|
/*
|
|
3
|
* FCKeditor - The text editor for Internet - http://www.fckeditor.net
|
|
4
|
* Copyright (C) 2003-2009 Frederico Caldeira Knabben
|
|
5
|
*
|
|
6
|
* == BEGIN LICENSE ==
|
|
7
|
*
|
|
8
|
* Licensed under the terms of any of the following licenses at your
|
|
9
|
* choice:
|
|
10
|
*
|
|
11
|
* - GNU General Public License Version 2 or later (the "GPL")
|
|
12
|
* http://www.gnu.org/licenses/gpl.html
|
|
13
|
*
|
|
14
|
* - GNU Lesser General Public License Version 2.1 or later (the "LGPL")
|
|
15
|
* http://www.gnu.org/licenses/lgpl.html
|
|
16
|
*
|
|
17
|
* - Mozilla Public License Version 1.1 or later (the "MPL")
|
|
18
|
* http://www.mozilla.org/MPL/MPL-1.1.html
|
|
19
|
*
|
|
20
|
* == END LICENSE ==
|
|
21
|
*
|
|
22
|
* Utility functions for the File Manager Connector for PHP.
|
|
23
|
*/
|
|
24
|
|
|
25
|
function RemoveFromStart( $sourceString, $charToRemove )
|
|
26
|
{
|
|
27
|
$sPattern = '|^' . $charToRemove . '+|' ;
|
|
28
|
return preg_replace( $sPattern, '', $sourceString ) ;
|
|
29
|
}
|
|
30
|
|
|
31
|
function RemoveFromEnd( $sourceString, $charToRemove )
|
|
32
|
{
|
|
33
|
$sPattern = '|' . $charToRemove . '+$|' ;
|
|
34
|
return preg_replace( $sPattern, '', $sourceString ) ;
|
|
35
|
}
|
|
36
|
|
|
37
|
function FindBadUtf8( $string )
|
|
38
|
{
|
|
39
|
$regex =
|
|
40
|
'([\x00-\x7F]'.
|
|
41
|
'|[\xC2-\xDF][\x80-\xBF]'.
|
|
42
|
'|\xE0[\xA0-\xBF][\x80-\xBF]'.
|
|
43
|
'|[\xE1-\xEC\xEE\xEF][\x80-\xBF]{2}'.
|
|
44
|
'|\xED[\x80-\x9F][\x80-\xBF]'.
|
|
45
|
'|\xF0[\x90-\xBF][\x80-\xBF]{2}'.
|
|
46
|
'|[\xF1-\xF3][\x80-\xBF]{3}'.
|
|
47
|
'|\xF4[\x80-\x8F][\x80-\xBF]{2}'.
|
|
48
|
'|(.{1}))';
|
|
49
|
|
|
50
|
while (preg_match('/'.$regex.'/S', $string, $matches)) {
|
|
51
|
if ( isset($matches[2])) {
|
|
52
|
return true;
|
|
53
|
}
|
|
54
|
$string = substr($string, strlen($matches[0]));
|
|
55
|
}
|
|
56
|
|
|
57
|
return false;
|
|
58
|
}
|
|
59
|
|
|
60
|
function ConvertToXmlAttribute( $value )
|
|
61
|
{
|
|
62
|
if ( defined( 'PHP_OS' ) )
|
|
63
|
{
|
|
64
|
$os = PHP_OS ;
|
|
65
|
}
|
|
66
|
else
|
|
67
|
{
|
|
68
|
$os = php_uname() ;
|
|
69
|
}
|
|
70
|
|
|
71
|
if ( strtoupper( substr( $os, 0, 3 ) ) === 'WIN' || FindBadUtf8( $value ) )
|
|
72
|
{
|
|
73
|
return ( utf8_encode( htmlspecialchars( $value ) ) ) ;
|
|
74
|
}
|
|
75
|
else
|
|
76
|
{
|
|
77
|
return ( htmlspecialchars( $value ) ) ;
|
|
78
|
}
|
|
79
|
}
|
|
80
|
|
|
81
|
/**
|
|
82
|
* Check whether given extension is in html etensions list
|
|
83
|
*
|
|
84
|
* @param string $ext
|
|
85
|
* @param array $htmlExtensions
|
|
86
|
* @return boolean
|
|
87
|
*/
|
|
88
|
function IsHtmlExtension( $ext, $htmlExtensions )
|
|
89
|
{
|
|
90
|
if ( !$htmlExtensions || !is_array( $htmlExtensions ) )
|
|
91
|
{
|
|
92
|
return false ;
|
|
93
|
}
|
|
94
|
$lcaseHtmlExtensions = array() ;
|
|
95
|
foreach ( $htmlExtensions as $key => $val )
|
|
96
|
{
|
|
97
|
$lcaseHtmlExtensions[$key] = strtolower( $val ) ;
|
|
98
|
}
|
|
99
|
return in_array( $ext, $lcaseHtmlExtensions ) ;
|
|
100
|
}
|
|
101
|
|
|
102
|
/**
|
|
103
|
* Detect HTML in the first KB to prevent against potential security issue with
|
|
104
|
* IE/Safari/Opera file type auto detection bug.
|
|
105
|
* Returns true if file contain insecure HTML code at the beginning.
|
|
106
|
*
|
|
107
|
* @param string $filePath absolute path to file
|
|
108
|
* @return boolean
|
|
109
|
*/
|
|
110
|
function DetectHtml( $filePath )
|
|
111
|
{
|
|
112
|
$fp = @fopen( $filePath, 'rb' ) ;
|
|
113
|
|
|
114
|
//open_basedir restriction, see #1906
|
|
115
|
if ( $fp === false || !flock( $fp, LOCK_SH ) )
|
|
116
|
{
|
|
117
|
return -1 ;
|
|
118
|
}
|
|
119
|
|
|
120
|
$chunk = fread( $fp, 1024 ) ;
|
|
121
|
flock( $fp, LOCK_UN ) ;
|
|
122
|
fclose( $fp ) ;
|
|
123
|
|
|
124
|
$chunk = strtolower( $chunk ) ;
|
|
125
|
|
|
126
|
if (!$chunk)
|
|
127
|
{
|
|
128
|
return false ;
|
|
129
|
}
|
|
130
|
|
|
131
|
$chunk = trim( $chunk ) ;
|
|
132
|
|
|
133
|
if ( preg_match( "/<!DOCTYPE\W*X?HTML/sim", $chunk ) )
|
|
134
|
{
|
|
135
|
return true;
|
|
136
|
}
|
|
137
|
|
|
138
|
$tags = array( '<body', '<head', '<html', '<img', '<pre', '<script', '<table', '<title' ) ;
|
|
139
|
|
|
140
|
foreach( $tags as $tag )
|
|
141
|
{
|
|
142
|
if( false !== strpos( $chunk, $tag ) )
|
|
143
|
{
|
|
144
|
return true ;
|
|
145
|
}
|
|
146
|
}
|
|
147
|
|
|
148
|
//type = javascript
|
|
149
|
if ( preg_match( '!type\s*=\s*[\'"]?\s*(?:\w*/)?(?:ecma|java)!sim', $chunk ) )
|
|
150
|
{
|
|
151
|
return true ;
|
|
152
|
}
|
|
153
|
|
|
154
|
//href = javascript
|
|
155
|
//src = javascript
|
|
156
|
//data = javascript
|
|
157
|
if ( preg_match( '!(?:href|src|data)\s*=\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) )
|
|
158
|
{
|
|
159
|
return true ;
|
|
160
|
}
|
|
161
|
|
|
162
|
//url(javascript
|
|
163
|
if ( preg_match( '!url\s*\(\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) )
|
|
164
|
{
|
|
165
|
return true ;
|
|
166
|
}
|
|
167
|
|
|
168
|
return false ;
|
|
169
|
}
|
|
170
|
|
|
171
|
/**
|
|
172
|
* Check file content.
|
|
173
|
* Currently this function validates only image files.
|
|
174
|
* Returns false if file is invalid.
|
|
175
|
*
|
|
176
|
* @param string $filePath absolute path to file
|
|
177
|
* @param string $extension file extension
|
|
178
|
* @param integer $detectionLevel 0 = none, 1 = use getimagesize for images, 2 = use DetectHtml for images
|
|
179
|
* @return boolean
|
|
180
|
*/
|
|
181
|
function IsImageValid( $filePath, $extension )
|
|
182
|
{
|
|
183
|
if (!@is_readable($filePath)) {
|
|
184
|
return -1;
|
|
185
|
}
|
|
186
|
|
|
187
|
$imageCheckExtensions = array('gif', 'jpeg', 'jpg', 'png', 'swf', 'psd', 'bmp', 'iff');
|
|
188
|
|
|
189
|
// version_compare is available since PHP4 >= 4.0.7
|
|
190
|
if ( function_exists( 'version_compare' ) ) {
|
|
191
|
$sCurrentVersion = phpversion();
|
|
192
|
if ( version_compare( $sCurrentVersion, "4.2.0" ) >= 0 ) {
|
|
193
|
$imageCheckExtensions[] = "tiff";
|
|
194
|
$imageCheckExtensions[] = "tif";
|
|
195
|
}
|
|
196
|
if ( version_compare( $sCurrentVersion, "4.3.0" ) >= 0 ) {
|
|
197
|
$imageCheckExtensions[] = "swc";
|
|
198
|
}
|
|
199
|
if ( version_compare( $sCurrentVersion, "4.3.2" ) >= 0 ) {
|
|
200
|
$imageCheckExtensions[] = "jpc";
|
|
201
|
$imageCheckExtensions[] = "jp2";
|
|
202
|
$imageCheckExtensions[] = "jpx";
|
|
203
|
$imageCheckExtensions[] = "jb2";
|
|
204
|
$imageCheckExtensions[] = "xbm";
|
|
205
|
$imageCheckExtensions[] = "wbmp";
|
|
206
|
}
|
|
207
|
}
|
|
208
|
|
|
209
|
if ( !in_array( $extension, $imageCheckExtensions ) ) {
|
|
210
|
return true;
|
|
211
|
}
|
|
212
|
|
|
213
|
if ( @getimagesize( $filePath ) === false ) {
|
|
214
|
return false ;
|
|
215
|
}
|
|
216
|
|
|
217
|
return true;
|
|
218
|
}
|
|
219
|
|
|
220
|
?>
|